Lesson 1 of 6
Lesson 1 — What Counts as Personal Data?
Names, emails, IP addresses, exam grades, photos — and why 'sensitive' data has extra rules.
Learn it
Personal data is any information that can identify a living person — directly (name, email) or indirectly (student ID, IP address, device ID).
Special category (sensitive) data includes health, ethnicity, religion, sexuality, biometrics and political views. It needs stronger protection.
If data is fully anonymised so nobody can be re-identified, privacy law mostly stops applying — but true anonymisation is hard.
Key terms
- Personal data
- Information relating to an identifiable living person.
- Special category data
- Sensitive data (health, biometrics, ethnicity…) with extra legal protection.
- Pseudonymisation
- Replacing identifiers with a key held separately; still personal data.
- Anonymisation
- Irreversibly removing identifiability so the data is no longer personal.
- Data classification
- Labelling data (public/internal/confidential/restricted) to drive handling rules.
Classify a school's data
A school stores lots of different files. Which tier does each belong to?
- 1Public: Term dates and the school address — publishing them causes no harm.
- 2Internal: Staff room rota and lesson plans — not secret, but not for the public.
- 3Confidential: Student names, addresses, attendance and grades — personal data.
- 4Restricted: Medical needs, safeguarding notes, free-school-meal status — special category data with the strictest access.
Pseudonymising a dataset
pythonimport hashlib
SALT = load_secret("pseudonym_salt") # kept away from the dataset
def pseudonym(student_email: str) -> str:
return hashlib.sha256((SALT + student_email).encode()).hexdigest()[:16]
row = {"id": pseudonym("ana.b@school.edu"), "grade": 78}
# Analysts see 'a91f...' not the email — but with the salt it is reversible,
# so this row is STILL personal data and must stay protected.Hashing hides the identifier from analysts but does not make the data anonymous — anyone with the salt and an email list can rebuild the mapping.
Try it
Personal data or not? Decide true or false.
An IP address logged by a web server can be personal data.
A pseudonymised student ID is no longer personal data.
A student's allergy record is special category data.
Total number of students in a school is personal data.
Challenge
A gaming company logs: username, email, IP address, device model, in-game purchases and a self-declared 'health accessibility mode'. Classify each field into a tier and say which fields need special protection and why.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 4 XP (never below 18 XP). You'd earn 35 XP right now.